For example, the DP-SGD analysis assumes that
the intermediate computations used
to train a model are published to the adversary,
when in most practical settings only the
final, fully-trained model is revealed.
This is done not because it is desirable—but because there are limited (known) ways to
improve the analysis by assuming the adversary has access to only one model [1]}.
As such, it is conceivable—and indeed likely—that
the actual privacy in practical scenarios is greater than
what can be shown theoretically (indeed, DP-SGD is known to be tight asymptotically [2]}).
